Privacy Policy
This policy explains how personal data is handled when you visit vectalight.com or contact us about our luminaires.
1. Who is responsible for your data?
The controller is Osaühing Vecta Design (Vecta Design OÜ), operating the Vecta Light website.
Registry code: 11249560
Registered address: Pärlimõisa tee 20, 80010 Pärnu, Estonia
Privacy enquiries: info@vectadesign.com
2. Contact and luminaire enquiries
Our forms collect your name, email address, message and the product or project details you provide. A telephone number and company name are optional. A luminaire enquiry may also include the model, size, frame height, colour, lighting controls, suspension and other selected specifications.
We use this information to answer questions, prepare quotations, discuss project requirements and handle resulting orders. Where you are the prospective contracting party, the legal basis is taking steps at your request before entering a contract or performing that contract (GDPR Article 6(1)(b)). For enquiries made on behalf of a business, we rely on our legitimate interest in responding to business communications (Article 6(1)(f)). Records required by law are processed under Article 6(1)(c).
Fields marked as required are needed to submit the relevant form. Providing your data is voluntary, but we may be unable to respond without contact information and the necessary enquiry details. You can also email us directly. Sending an enquiry does not constitute consent to promotional emails.
3. Technical data and website services
Visiting the website or using its external services involves technical data such as your IP address, browser and device information, requested page, time of request and referring page. We use technical processing to deliver the site, handle submissions and protect it against misuse. Our legitimate interest is maintaining a reliable and secure website (Article 6(1)(f)). Optional statistics are subject to your consent, as explained below.
| Service | Purpose and data involved |
|---|---|
| Amazon Web Services (AWS Lightsail) | Hosts the website and its server infrastructure. Website delivery and server operation involve technical connection information, including IP addresses and request information. AWS data privacy information. |
| Formspree, Inc. | Processes submissions from our contact and luminaire enquiry forms. Receives the submitted fields and technical submission information, and delivers form messages to us. Formspree states that it processes data in the United States and other countries where it operates. Provider privacy policy. |
| Google Workspace | Provides our business email service. Processes enquiry messages, sender and recipient details, attachments you send and related email-delivery information. Google Cloud Data Processing Addendum. |
| Google reCAPTCHA | Loads only when you choose to activate Google reCAPTCHA beside a contact or luminaire enquiry form. It helps detect automated abuse, processes technical and interaction signals and may store the _GRECAPTCHA security cookie. Google describes its processing of reCAPTCHA customer data as processing on its customer’s behalf under the Cloud Data Processing Addendum. Provider information. |
| Locally hosted Inter fonts | The Inter typeface files are served from this website rather than Google Fonts servers. Loading these fonts does not require a connection to Google Fonts. |
| Jetpack Stats / Automattic | Provides visit and link-click statistics when you accept statistics. Its documentation identifies visitor IP addresses, browser information, referring URLs and visited URLs among the data collected. Jetpack Stats privacy information and Automattic’s visitor privacy notice. |
Cookies and similar storage
We store your statistics choice in the sol_cookie_consent preference cookie for 180 days. This cookie remembers your choice and is not used for advertising. Jetpack Stats loads only after you accept statistics; the legal basis for optional statistics is consent (GDPR Article 6(1)(a)). You can reject statistics or change and withdraw your choice through “Cookie settings” at the bottom of the page. Withdrawal stops future statistics loads and does not affect processing already lawfully carried out.
The statistics choice is separate from form protection. Google reCAPTCHA is not loaded automatically when the page opens or when you open a luminaire enquiry. You can choose to activate it beside the form after reading the notice, or contact us directly by email without activating it. Activation connects your browser to Google and may set a security cookie. To stop further reCAPTCHA loads, reload the page and do not activate it again; this does not undo information already sent. You can remove its existing cookies using browser controls. Fonts are served locally. WordPress uses browser storage to check emoji support. You can also use your browser controls to inspect, block or delete cookies and site storage; blocking them may affect website functions. Using the website or sending an enquiry does not constitute consent to optional statistics.
4. Who receives the data?
Data is available to authorised staff handling your request and to the service providers needed for website hosting, domain-name resolution, security, forms, business email and statistics. The principal providers are described above. Information may also be disclosed to professional advisers or public authorities where necessary for a legal obligation or a legal claim.
5. How long is data kept?
There is no single fixed deletion period for all enquiries. Enquiry information may be held in our form service and business email. The retention period depends on the time needed to answer the enquiry, whether it leads to a quotation or project, any continuing contractual or warranty obligations, and whether the information is needed to meet a legal obligation or establish, exercise or defend a legal claim. An enquiry does not automatically become a record that must be kept for seven years.
Accounting source documents and business records needed to reconstruct transactions are generally retained for seven years from the end of the relevant financial year under §12 of the Estonian Accounting Act. Business documents relating to long-term rights or obligations are retained for seven years after their validity expires.
The retention of technical logs and backup copies depends on their operational purpose, the relevant service settings, and any need to investigate security incidents or comply with legal obligations. We do not specify a universal automatic deletion period for these records. Automattic’s Jetpack Stats documentation states that identifiable Stats logs are retained for 28 days; this does not establish the retention of every other website record or aggregated statistics.
You can contact info@vectadesign.com about a particular record or request erasure, subject to the conditions and exceptions in the GDPR.
6. Transfers outside the EEA
Some providers and their subprocessors process data outside the European Economic Area (EEA), including in the United States. The safeguards described in their published documentation include the following:
- Formspree states that it relies on Standard Contractual Clauses (SCCs) as a data processor.
- AWS incorporates its Data Processing Addendum into its service terms, with SCCs for relevant transfers to countries without an applicable adequacy decision. See AWS’s explanation of its data-processing terms.
- Google states that Google LLC participates in the EU–US Data Privacy Framework for covered transfers to the United States. Its Cloud transfer notice and Cloud Data Processing Addendum describe the arrangements for Google Workspace and reCAPTCHA, including SCCs where applicable. Google’s general transfer information describes the mechanisms for services covered by its Privacy Policy, including adequacy mechanisms and SCCs where required.
- Automattic describes the use of European Commission-approved contractual safeguards for transfers outside the EEA in its privacy information.
The applicable mechanism depends on the provider, recipient and processing involved. The linked documents provide information about these safeguards. You may also contact info@vectadesign.com for information about a transfer involving your data or how to obtain a copy of the relevant safeguards.
7. Your rights
Subject to the GDPR’s conditions, you can request access to your data, correction, erasure, restriction or portability. You may object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time. Where processing is based on consent, you may withdraw it without affecting processing already lawfully carried out.
Send requests to info@vectadesign.com. We respond without undue delay and normally within one month; an extension is possible in the cases allowed by the GDPR. Proportionate verification may be necessary to protect your data.
You can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, at www.aki.ee, or to another competent supervisory authority, including in your country of residence.
8. Policy updates
We update this policy when the website’s processing changes. The version date appears at the top of this page. Questions about this policy can be sent to info@vectadesign.com.